#pragma once

#ifndef _WIN64
#define DUMP_BLOCK_SIZE        0x20000
#else
#define DUMP_BLOCK_SIZE        0x40000
#endif

#ifndef _WIN64
#define KDDEBUGGER_DATA_OFFSET 0x1068
#else
#define KDDEBUGGER_DATA_OFFSET 0x2080
#endif


typedef struct _DBGKD_DEBUG_DATA_HEADER64 {
    LIST_ENTRY64 List;
    ULONG           OwnerTag;
    ULONG           Size;
} DBGKD_DEBUG_DATA_HEADER64, * PDBGKD_DEBUG_DATA_HEADER64;

typedef struct _KDDEBUGGER_DATA64 {

    DBGKD_DEBUG_DATA_HEADER64 Header;

    //
    // Base address of kernel image
    //

    ULONG64   KernBase;

    //
    // DbgBreakPointWithStatus is a function which takes an argument
    // and hits a breakpoint.  This field contains the address of the
    // breakpoint instruction.  When the debugger sees a breakpoint
    // at this address, it may retrieve the argument from the first
    // argument register, or on x86 the eax register.
    //

    ULONG64   BreakpointWithStatus;       // address of breakpoint

    //
    // Address of the saved context record during a bugcheck
    //
    // N.B. This is an automatic in KeBugcheckEx's frame, and
    // is only valid after a bugcheck.
    //

    ULONG64   SavedContext;

    //
    // help for walking stacks with user callbacks:
    //

    //
    // The address of the thread structure is provided in the
    // WAIT_STATE_CHANGE packet.  This is the offset from the base of
    // the thread structure to the pointer to the kernel stack frame
    // for the currently active usermode callback.
    //

    USHORT  ThCallbackStack;            // offset in thread data

    //
    // these values are offsets into that frame:
    //

    USHORT  NextCallback;               // saved pointer to next callback frame
    USHORT  FramePointer;               // saved frame pointer

    //
    // pad to a quad boundary
    //
    USHORT  PaeEnabled;

    //
    // Address of the kernel callout routine.
    //

    ULONG64   KiCallUserMode;             // kernel routine

    //
    // Address of the usermode entry point for callbacks.
    //

    ULONG64   KeUserCallbackDispatcher;   // address in ntdll


    //
    // Addresses of various kernel data structures and lists
    // that are of interest to the kernel debugger.
    //

    ULONG64   PsLoadedModuleList;
    ULONG64   PsActiveProcessHead;
    ULONG64   PspCidTable;

    ULONG64   ExpSystemResourcesList;
    ULONG64   ExpPagedPoolDescriptor;
    ULONG64   ExpNumberOfPagedPools;

    ULONG64   KeTimeIncrement;
    ULONG64   KeBugCheckCallbackListHead;
    ULONG64   KiBugcheckData;

    ULONG64   IopErrorLogListHead;

    ULONG64   ObpRootDirectoryObject;
    ULONG64   ObpTypeObjectType;

    ULONG64   MmSystemCacheStart;
    ULONG64   MmSystemCacheEnd;
    ULONG64   MmSystemCacheWs;

    ULONG64   MmPfnDatabase;
    ULONG64   MmSystemPtesStart;
    ULONG64   MmSystemPtesEnd;
    ULONG64   MmSubsectionBase;
    ULONG64   MmNumberOfPagingFiles;

    ULONG64   MmLowestPhysicalPage;
    ULONG64   MmHighestPhysicalPage;
    ULONG64   MmNumberOfPhysicalPages;

    ULONG64   MmMaximumNonPagedPoolInBytes;
    ULONG64   MmNonPagedSystemStart;
    ULONG64   MmNonPagedPoolStart;
    ULONG64   MmNonPagedPoolEnd;

    ULONG64   MmPagedPoolStart;
    ULONG64   MmPagedPoolEnd;
    ULONG64   MmPagedPoolInformation;
    ULONG64   MmPageSize;

    ULONG64   MmSizeOfPagedPoolInBytes;

    ULONG64   MmTotalCommitLimit;
    ULONG64   MmTotalCommittedPages;
    ULONG64   MmSharedCommit;
    ULONG64   MmDriverCommit;
    ULONG64   MmProcessCommit;
    ULONG64   MmPagedPoolCommit;
    ULONG64   MmExtendedCommit;

    ULONG64   MmZeroedPageListHead;
    ULONG64   MmFreePageListHead;
    ULONG64   MmStandbyPageListHead;
    ULONG64   MmModifiedPageListHead;
    ULONG64   MmModifiedNoWritePageListHead;
    ULONG64   MmAvailablePages;
    ULONG64   MmResidentAvailablePages;

    ULONG64   PoolTrackTable;
    ULONG64   NonPagedPoolDescriptor;

    ULONG64   MmHighestUserAddress;
    ULONG64   MmSystemRangeStart;
    ULONG64   MmUserProbeAddress;

    ULONG64   KdPrintCircularBuffer;
    ULONG64   KdPrintCircularBufferEnd;
    ULONG64   KdPrintWritePointer;
    ULONG64   KdPrintRolloverCount;

    ULONG64   MmLoadedUserImageList;

    // NT 5.1 Addition

    ULONG64   NtBuildLab;
    ULONG64   KiNormalSystemCall;

    // NT 5.0 hotfix addition

    ULONG64   KiProcessorBlock;
    ULONG64   MmUnloadedDrivers;
    ULONG64   MmLastUnloadedDriver;
    ULONG64   MmTriageActionTaken;
    ULONG64   MmSpecialPoolTag;
    ULONG64   KernelVerifier;
    ULONG64   MmVerifierData;
    ULONG64   MmAllocatedNonPagedPool;
    ULONG64   MmPeakCommitment;
    ULONG64   MmTotalCommitLimitMaximum;
    ULONG64   CmNtCSDVersion;

    // NT 5.1 Addition

    ULONG64   MmPhysicalMemoryBlock;
    ULONG64   MmSessionBase;
    ULONG64   MmSessionSize;
    ULONG64   MmSystemParentTablePage;

    // Server 2003 addition

    ULONG64   MmVirtualTranslationBase;

    USHORT    OffsetKThreadNextProcessor;
    USHORT    OffsetKThreadTeb;
    USHORT    OffsetKThreadKernelStack;
    USHORT    OffsetKThreadInitialStack;

    USHORT    OffsetKThreadApcProcess;
    USHORT    OffsetKThreadState;
    USHORT    OffsetKThreadBStore;
    USHORT    OffsetKThreadBStoreLimit;

    USHORT    SizeEProcess;
    USHORT    OffsetEprocessPeb;
    USHORT    OffsetEprocessParentCID;
    USHORT    OffsetEprocessDirectoryTableBase;

    USHORT    SizePrcb;
    USHORT    OffsetPrcbDpcRoutine;
    USHORT    OffsetPrcbCurrentThread;
    USHORT    OffsetPrcbMhz;

    USHORT    OffsetPrcbCpuType;
    USHORT    OffsetPrcbVendorString;
    USHORT    OffsetPrcbProcStateContext;
    USHORT    OffsetPrcbNumber;

    USHORT    SizeEThread;

    ULONG64   KdPrintCircularBufferPtr;
    ULONG64   KdPrintBufferSize;

    ULONG64   KeLoaderBlock;

    USHORT    SizePcr;
    USHORT    OffsetPcrSelfPcr;
    USHORT    OffsetPcrCurrentPrcb;
    USHORT    OffsetPcrContainedPrcb;

    USHORT    OffsetPcrInitialBStore;
    USHORT    OffsetPcrBStoreLimit;
    USHORT    OffsetPcrInitialStack;
    USHORT    OffsetPcrStackLimit;

    USHORT    OffsetPrcbPcrPage;
    USHORT    OffsetPrcbProcStateSpecialReg;
    USHORT    GdtR0Code;
    USHORT    GdtR0Data;

    USHORT    GdtR0Pcr;
    USHORT    GdtR3Code;
    USHORT    GdtR3Data;
    USHORT    GdtR3Teb;

    USHORT    GdtLdt;
    USHORT    GdtTss;
    USHORT    Gdt64R3CmCode;
    USHORT    Gdt64R3CmTeb;

    ULONG64   IopNumTriageDumpDataBlocks;
    ULONG64   IopTriageDumpDataBlocks;

    // Longhorn addition

    ULONG64   VfCrashDataBlock;
    ULONG64   MmBadPagesDetected;
    ULONG64   MmZeroedPageSingleBitErrorsDetected;

    // Windows 7 addition

    ULONG64   EtwpDebuggerData;
    USHORT    OffsetPrcbContext;

    // Windows 8 addition

    USHORT    OffsetPrcbMaxBreakpoints;
    USHORT    OffsetPrcbMaxWatchpoints;

    ULONG     OffsetKThreadStackLimit;
    ULONG     OffsetKThreadStackBase;
    ULONG     OffsetKThreadQueueListEntry;
    ULONG     OffsetEThreadIrpList;

    USHORT    OffsetPrcbIdleThread;
    USHORT    OffsetPrcbNormalDpcState;
    USHORT    OffsetPrcbDpcStack;
    USHORT    OffsetPrcbIsrStack;

    USHORT    SizeKDPC_STACK_FRAME;

    // Windows 8.1 Addition

    USHORT    OffsetKPriQueueThreadListHead;
    USHORT    OffsetKThreadWaitReason;

    // Windows 10 RS1 Addition

    USHORT    Padding;
    ULONG64   PteBase;

    // Windows 10 RS5 Addition

    ULONG64 RetpolineStubFunctionTable;
    ULONG RetpolineStubFunctionTableSize;
    ULONG RetpolineStubOffset;
    ULONG RetpolineStubSize;

} KDDEBUGGER_DATA64, * PKDDEBUGGER_DATA64;

typedef struct _DUMP_HEADER
{
    ULONG Signature;
    ULONG ValidDump;
    ULONG MajorVersion;
    ULONG MinorVersion;
    ULONG_PTR DirectoryTableBase;
    ULONG_PTR PfnDataBase;
    PLIST_ENTRY PsLoadedModuleList;
    PLIST_ENTRY PsActiveProcessHead;
    ULONG MachineImageType;
    ULONG NumberProcessors;
    ULONG BugCheckCode;
    ULONG_PTR BugCheckParameter1;
    ULONG_PTR BugCheckParameter2;
    ULONG_PTR BugCheckParameter3;
    ULONG_PTR BugCheckParameter4;
    CHAR VersionUser[32];
    struct _KDDEBUGGER_DATA64* KdDebuggerDataBlock;
} DUMP_HEADER, * PDUMP_HEADER;


#pragma warning(push)
#pragma warning(disable : 4201)
struct _CONTROL_AREA;
struct _SEGMENT_OBJECT;

//0x30 bytes (sizeof)
typedef struct _SECTION_OBJECT
{
    VOID* StartingVa;                                                       //0x0
    VOID* EndingVa;                                                         //0x8
    VOID* Parent;                                                           //0x10
    VOID* LeftChild;                                                        //0x18
    VOID* RightChild;                                                       //0x20
    struct _SEGMENT* Segment;                                               //0x28
}SECTION_OBJECT, * PSECTION_OBJECT;

//0x40 bytes (sizeof)
typedef struct _SEGMENT_OBJECT
{
    VOID* BaseAddress;                                                      //0x0
    ULONG TotalNumberOfPtes;                                                //0x8
    union _LARGE_INTEGER SizeOfSegment;                                     //0x10
    ULONG NonExtendedPtes;                                                  //0x18
    ULONG ImageCommitment;                                                  //0x1c
    struct _CONTROL_AREA* ControlArea;                                      //0x20
    VOID* Subsection;                                         //0x28
    VOID* MmSectionFlags;                                //0x30
    VOID* MmSubSectionFlags;                          //0x38
}SEGMENT_OBJECT, * PSEGMENT_OBJECT;

//0x4 bytes (sizeof)
struct _SEGMENT_FLAGS
{
    ULONG TotalNumberOfPtes4132 : 10;                                         //0x0
    ULONG ExtraSharedWowSubsections : 1;                                      //0x0
    ULONG LargePages : 1;                                                     //0x0
    ULONG WatchProto : 1;                                                     //0x0
    ULONG DebugSymbolsLoaded : 1;                                             //0x0
    ULONG WriteCombined : 1;                                                  //0x0
    ULONG NoCache : 1;                                                        //0x0
    ULONG FloppyMedia : 1;                                                    //0x0
    ULONG DefaultProtectionMask : 5;                                          //0x0
    ULONG Binary32 : 1;                                                       //0x0
    ULONG ContainsDebug : 1;                                                  //0x0
    ULONG Spare : 8;                                                          //0x0
};

//0x10 bytes (sizeof)
struct _MMEXTEND_INFO
{
    ULONGLONG CommittedSize;                                                //0x0
    ULONG ReferenceCount;                                                   //0x8
}; 

//0x8 bytes (sizeof)
struct _EX_PUSH_LOCK
{
    union
    {
        struct
        {
            ULONGLONG Locked:1;                                             //0x0
            ULONGLONG Waiting:1;                                            //0x0
            ULONGLONG Waking:1;                                             //0x0
            ULONGLONG MultipleShared:1;                                     //0x0
            ULONGLONG Shared:60;                                            //0x0
        };
        ULONGLONG Value;                                                    //0x0
        VOID* Ptr;                                                          //0x0
    };
}; 

//0x40 bytes (sizeof)
struct _SECTION_IMAGE_INFORMATION
{
    VOID* TransferAddress;                                                  //0x0
    ULONG ZeroBits;                                                         //0x8
    ULONGLONG MaximumStackSize;                                             //0x10
    ULONGLONG CommittedStackSize;                                           //0x18
    ULONG SubSystemType;                                                    //0x20
    union
    {
        struct
        {
            USHORT SubSystemMinorVersion;                                   //0x24
            USHORT SubSystemMajorVersion;                                   //0x26
        };
        ULONG SubSystemVersion;                                             //0x24
    };
    ULONG GpValue;                                                          //0x28
    USHORT ImageCharacteristics;                                            //0x2c
    USHORT DllCharacteristics;                                              //0x2e
    USHORT Machine;                                                         //0x30
    UCHAR ImageContainsCode;                                                //0x32
    union
    {
        UCHAR ImageFlags;                                                   //0x33
        struct
        {
            UCHAR ComPlusNativeReady:1;                                     //0x33
            UCHAR ComPlusILOnly:1;                                          //0x33
            UCHAR ImageDynamicallyRelocated:1;                              //0x33
            UCHAR ImageMappedFlat:1;                                        //0x33
            UCHAR Reserved:4;                                               //0x33
        };
    };
    ULONG LoaderFlags;                                                      //0x34
    ULONG ImageFileSize;                                                    //0x38
    ULONG CheckSum;                                                         //0x3c
}; 

//0x8 bytes (sizeof)
struct _MI_EXTRA_IMAGE_INFORMATION
{
    ULONG SizeOfHeaders;                                                    //0x0
    ULONG SizeOfImage;                                                      //0x4
}; 

//0x48 bytes (sizeof)
struct _MI_SECTION_IMAGE_INFORMATION
{
    struct _SECTION_IMAGE_INFORMATION ExportedImageInformation;             //0x0
    struct _MI_EXTRA_IMAGE_INFORMATION InternalImageInformation;            //0x40
}; 

//0x50 bytes (sizeof)
struct _SEGMENT
{
    struct _CONTROL_AREA* ControlArea;                                      //0x0
    ULONG TotalNumberOfPtes;                                                //0x8
    struct _SEGMENT_FLAGS SegmentFlags;                                     //0xc
    ULONGLONG NumberOfCommittedPages;                                       //0x10
    ULONGLONG SizeOfSegment;                                                //0x18
    union
    {
        struct _MMEXTEND_INFO* ExtendInfo;                                  //0x20
        VOID* BasedAddress;                                                 //0x20
    };
    struct _EX_PUSH_LOCK SegmentLock;                                       //0x28
    union
    {
        ULONGLONG ImageCommitment;                                          //0x30
        struct _EPROCESS* CreatingProcess;                                  //0x30
    } u1;                                                                   //0x30
    union
    {
        struct _MI_SECTION_IMAGE_INFORMATION* ImageInformation;             //0x38
        VOID* FirstMappedVa;                                                //0x38
    } u2;                                                                   //0x38
    PULONG* PrototypePte;                                                   //0x40
    ULONG ThePtes[1];                                                       //0x48
};

//0x4 bytes (sizeof)
struct _MMSECTION_FLAGS
{
    ULONG BeingDeleted:1;                                                   //0x0
    ULONG BeingCreated:1;                                                   //0x0
    ULONG BeingPurged:1;                                                    //0x0
    ULONG NoModifiedWriting:1;                                              //0x0
    ULONG FailAllIo:1;                                                      //0x0
    ULONG Image:1;                                                          //0x0
    ULONG Based:1;                                                          //0x0
    ULONG File:1;                                                           //0x0
    ULONG Networked:1;                                                      //0x0
    ULONG Rom:1;                                                            //0x0
    ULONG PhysicalMemory:1;                                                 //0x0
    ULONG CopyOnWrite:1;                                                    //0x0
    ULONG Reserve:1;                                                        //0x0
    ULONG Commit:1;                                                         //0x0
    ULONG Accessed:1;                                                       //0x0
    ULONG WasPurged:1;                                                      //0x0
    ULONG UserReference:1;                                                  //0x0
    ULONG GlobalMemory:1;                                                   //0x0
    ULONG DeleteOnClose:1;                                                  //0x0
    ULONG FilePointerNull:1;                                                //0x0
    ULONG GlobalOnlyPerSession:1;                                           //0x0
    ULONG SetMappedFileIoComplete:1;                                        //0x0
    ULONG CollidedFlush:1;                                                  //0x0
    ULONG NoChange:1;                                                       //0x0
    ULONG Spare:1;                                                          //0x0
    ULONG UserWritable:1;                                                   //0x0
    ULONG PreferredNode:6;                                                  //0x0
}; 

//0x8 bytes (sizeof)
struct _EX_FAST_REF
{
    union
    {
        VOID* Object;                                                       //0x0
        ULONGLONG RefCnt:4;                                                 //0x0
        ULONGLONG Value;                                                    //0x0
    };
}; 

//0x20 bytes (sizeof)
struct _MI_SECTION_CREATION_GATE
{
    struct _MI_SECTION_CREATION_GATE* Next;                                 //0x0
    struct _KGATE Gate;                                                     //0x8
}; 

//0x80 bytes (sizeof)
typedef struct _CONTROL_AREA
{
    struct _SEGMENT* Segment;                                               //0x0
    struct _LIST_ENTRY DereferenceList;                                     //0x8
    ULONGLONG NumberOfSectionReferences;                                    //0x18
    ULONGLONG NumberOfPfnReferences;                                        //0x20
    ULONGLONG NumberOfMappedViews;                                          //0x28
    ULONGLONG NumberOfUserReferences;                                       //0x30
    union
    {
        ULONG LongFlags;                                                    //0x38
        struct _MMSECTION_FLAGS Flags;                                      //0x38
    } u;                                                                    //0x38
    ULONG FlushInProgressCount;                                             //0x3c
    struct _EX_FAST_REF FilePointer;                                        //0x40
    volatile LONG ControlAreaLock;                                          //0x48
    union
    {
        ULONG ModifiedWriteCount;                                           //0x4c
        ULONG StartingFrame;                                                //0x4c
    };
    struct _MI_SECTION_CREATION_GATE* WaitingForDeletion;                   //0x50
    union
    {
        struct
        {
            union
            {
                ULONG NumberOfSystemCacheViews;                             //0x58
                ULONG ImageRelocationStartBit;                              //0x58
            };
            union
            {
                volatile LONG WritableUserReferences;                       //0x5c
                struct
                {
                    ULONG ImageRelocationSizeIn64k : 16;                      //0x5c
                    ULONG Unused : 14;                                        //0x5c
                    ULONG BitMap64 : 1;                                       //0x5c
                    ULONG ImageActive : 1;                                    //0x5c
                };
            };
            union
            {
                PVOID SubsectionRoot;                                         //0x60
                PVOID SeImageStub;                                          //0x60
            };
        } e2;                                                               //0x58
    } u2;                                                                   //0x58
    volatile LONGLONG LockedPages;                                          //0x68
    struct _LIST_ENTRY ViewList;                                            //0x70
}CONTROL_AREA, * PCONTROL_AREA;

//0x38 bytes (sizeof)
typedef struct _OBJECT_HEADER
{
    LONGLONG PointerCount;                                                  //0x0
    union
    {
        LONGLONG HandleCount;                                               //0x8
        VOID* NextToFree;                                                   //0x8
    };
    struct _EX_PUSH_LOCK Lock;                                              //0x10
    UCHAR TypeIndex;                                                        //0x18
    UCHAR TraceFlags;                                                       //0x19
    UCHAR InfoMask;                                                         //0x1a
    UCHAR Flags;                                                            //0x1b
    union
    {
        VOID* ObjectCreateInfo;                                             //0x20
        VOID* QuotaBlockCharged;                                            //0x20
    };
    VOID* SecurityDescriptor;                                               //0x28
    struct _QUAD Body;                                                      //0x30
}OBJECT_HEADER, * POBJECT_HEADER;

typedef struct _LDR_DATA_TABLE_ENTRY
{
    LIST_ENTRY  InLoadOrderModuleList;
    LIST_ENTRY  InMemoryOrderModuleList;
    LIST_ENTRY  InInitializationOrderModuleList;
    PVOID DllBase;
    PVOID EntryPoint;
    ULONG SizeOfImage;
    UNICODE_STRING FullDllName;
    UNICODE_STRING BaseDllName;
    ULONG Flags;
    USHORT LoadCount;
    USHORT TlsIndex;
    union
    {
        LIST_ENTRY HashLinks;
        struct
        {
            PVOID SectionPointer;
            ULONG CheckSum;
        };
    };
    union
    {
        ULONG TimeDateStamp;
        PVOID LoadedImports;
    };
    PVOID EntryPointActivationContext;
    PVOID PatchInformation;
    LIST_ENTRY ForwarderLinks;
    LIST_ENTRY ServiceTagLinks;
    LIST_ENTRY StaticLinks;
} LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY;

//0x10 bytes (sizeof)
typedef struct _POOL_HEADER
{
    union
    {
        struct
        {
            ULONG PreviousSize : 8;                                           //0x0
            ULONG PoolIndex : 8;                                              //0x0
            ULONG BlockSize : 8;                                              //0x0
            ULONG PoolType : 8;                                               //0x0
        };
        ULONG Ulong1;                                                       //0x0
    };
    ULONG PoolTag;                                                          //0x4
    union
    {
        struct _EPROCESS* ProcessBilled;                                    //0x8
        struct
        {
            USHORT AllocatorBackTraceIndex;                                 //0x8
            USHORT PoolTagHash;                                             //0xa
        };
    };
}POOL_HEADER, * PPOOL_HEADER;

#pragma warning(pop)
